Hackers impersonate IT help desk on Microsoft Teams to gain domain admin via AD CS attacks
THREAT ACTORActive Directory Certificate Servicesredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Attackers impersonated IT help desk staff on Microsoft Teams to obtain remote access, then abused Active Directory Certificate Services to turn support sessions into privileged authentication paths. Microsoft disclosed two intrusions on October 30, 2026, involving certificate template abuse and NTLM relay. The attacks did not exploit a Teams vulnerability.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Read Microsoft's full disclosure for detection and mitigation guidance, as the excerpt is truncated.
- Verify the identity of anyone claiming to be help desk staff before approving remote access sessions.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
GBHackers
Who and what is in it
Companies